linux file命令檢視elf檔案資訊
阿新 • • 發佈:2019-01-08
使用file命令檢視動態連結庫, 得到如下結果:
#/usr/libx32$ file ../lib32/libgomp.so.1.0.0
../lib32/libgomp.so.1.0.0: ELF 32-bit
LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, BuildID[sha1]=57ec5c404cd4f781ac341332437a6960784e4581, stripped
#:/usr/libx32$ file ../libx32/libgcc_s.so.1
../libx32/libgcc_s.so.1: ELF 32-bit
LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=4713f15844e2b3e13f741bd5acef9aaab24cff03, stripped
其中比較讓我困惑的紅字部分,
ELF 32-bit表示這個elf檔案是elf32的, ELF64-bit表示elf檔案是elf64的
typedef struct elf32_hdr { unsigned char e_ident[EI_NIDENT]; Elf32_Half e_type; Elf32_Half e_machine; Elf32_Word e_version; Elf32_Addr e_entry; /* Entry point */ Elf32_Off e_phoff; Elf32_Off e_shoff; Elf32_Word e_flags; Elf32_Half e_ehsize; Elf32_Half e_phentsize; Elf32_Half e_phnum; Elf32_Half e_shentsize; Elf32_Half e_shnum; Elf32_Half e_shstrndx; } Elf32_Ehdr; typedef struct elf64_hdr { unsigned char e_ident[16]; /* ELF "magic number" */ Elf64_Half e_type; Elf64_Half e_machine; Elf64_Word e_version; Elf64_Addr e_entry; /* Entry point virtual address */ Elf64_Off e_phoff; /* Program header table file offset */ Elf64_Off e_shoff; /* Section header table file offset */ Elf64_Word e_flags; Elf64_Half e_ehsize; Elf64_Half e_phentsize; Elf64_Half e_phnum; Elf64_Half e_shentsize; Elf64_Half e_shnum; Elf64_Half e_shstrndx; } Elf64_Ehdr;
對於elf32和elf64頭,二者的前16位元組是Magic, Magic第五個位元組定義了elf檔案的格式.
Intel 80386和x86-64則定義了目標機器的型別,也就是目標機器的指令集